Skip to content

Commit 4925362

Browse files
adulauadulau
authored
Merge pull request #506 from MISP/codex/add-support-for-contact-list-extraction
Add `contact-list` MISP object for forensic mobile extraction use-cases
2 parents ece467c + 83f747f commit 4925362

2 files changed

Lines changed: 169 additions & 0 deletions

File tree

‎README.md‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -147,6 +147,7 @@ for a specific attribute. An optional **to_ids** boolean field to disable the ID
147147
- [objects/command-line](https://github.com/MISP/misp-objects/blob/main/objects/command-line/definition.json) - Command line and options related to a specific command executed by a program, whether it is malicious or not.
148148
- [objects/concordia-mtmf-intrusion-set](https://github.com/MISP/misp-objects/blob/main/objects/concordia-mtmf-intrusion-set/definition.json) - Intrusion Set - Phase Description.
149149
- [objects/confidentiality-impact](https://github.com/MISP/misp-objects/blob/main/objects/confidentiality-impact/definition.json) - Confidentiality Impact object as described in STIX 2.1 Incident object extension.
150+
- [objects/contact-list](https://github.com/MISP/misp-objects/blob/main/objects/contact-list/definition.json) - Contact list object template for entries or aggregated exports extracted from devices, SIM cards or cloud backups during forensic investigations (including Cellebrite and similar tools).
150151
- [objects/container-image](https://github.com/MISP/misp-objects/blob/main/objects/container-image/definition.json) - Generic container-image object template to represent container images across platforms.
151152
- [objects/container-instance](https://github.com/MISP/misp-objects/blob/main/objects/container-instance/definition.json) - Generic container-instance object template to represent runtime container details.
152153
- [objects/container-network](https://github.com/MISP/misp-objects/blob/main/objects/container-network/definition.json) - Generic container-network object template to represent container networking settings.

‎objects/contact-list/definition.json‎

Lines changed: 168 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,168 @@
1+
{
2+
"attributes": {
3+
"address": {
4+
"description": "Postal address associated with the contact.",
5+
"disable_correlation": true,
6+
"misp-attribute": "text",
7+
"multiple": true,
8+
"ui-priority": 0
9+
},
10+
"contact-count": {
11+
"description": "Number of contacts represented in the extracted contact list.",
12+
"disable_correlation": true,
13+
"misp-attribute": "counter",
14+
"ui-priority": 0
15+
},
16+
"contact-id": {
17+
"description": "Identifier of the contact in the source platform or extraction output.",
18+
"misp-attribute": "text",
19+
"ui-priority": 2
20+
},
21+
"e-mail": {
22+
"description": "Email address associated with the contact.",
23+
"misp-attribute": "email-src",
24+
"multiple": true,
25+
"ui-priority": 2
26+
},
27+
"extracted-at": {
28+
"description": "Date and time when the contact list was extracted.",
29+
"disable_correlation": true,
30+
"misp-attribute": "datetime",
31+
"ui-priority": 0
32+
},
33+
"extraction-reference": {
34+
"description": "Reference to extraction artifact, report or case record.",
35+
"disable_correlation": true,
36+
"misp-attribute": "link",
37+
"multiple": true,
38+
"ui-priority": 0
39+
},
40+
"extraction-tool": {
41+
"description": "Tool used to extract the contact list from the device, SIM or cloud backup.",
42+
"disable_correlation": true,
43+
"misp-attribute": "text",
44+
"sane_default": [
45+
"Cellebrite UFED",
46+
"Cellebrite Physical Analyzer",
47+
"MSAB XRY",
48+
"Magnet AXIOM",
49+
"Oxygen Forensic Detective",
50+
"Belkasoft X",
51+
"Elcomsoft iOS Forensic Toolkit",
52+
"Other"
53+
],
54+
"ui-priority": 0
55+
},
56+
"extraction-type": {
57+
"description": "Acquisition type used to obtain the contact list.",
58+
"disable_correlation": true,
59+
"misp-attribute": "text",
60+
"sane_default": [
61+
"Manual",
62+
"Logical extraction",
63+
"File system extraction",
64+
"Physical extraction",
65+
"Cloud extraction",
66+
"SIM extraction",
67+
"Other"
68+
],
69+
"ui-priority": 0
70+
},
71+
"first-name": {
72+
"description": "First name of the contact.",
73+
"misp-attribute": "first-name",
74+
"ui-priority": 3
75+
},
76+
"full-name": {
77+
"description": "Display or full name of the contact.",
78+
"misp-attribute": "full-name",
79+
"ui-priority": 4
80+
},
81+
"handle": {
82+
"description": "Username, account handle or identifier linked to the contact.",
83+
"misp-attribute": "text",
84+
"multiple": true,
85+
"ui-priority": 1
86+
},
87+
"job-title": {
88+
"description": "Job title or role associated with the contact.",
89+
"disable_correlation": true,
90+
"misp-attribute": "text",
91+
"ui-priority": 0
92+
},
93+
"last-modified": {
94+
"description": "Date and time when the contact entry was last modified on the source.",
95+
"disable_correlation": true,
96+
"misp-attribute": "datetime",
97+
"ui-priority": 0
98+
},
99+
"last-name": {
100+
"description": "Last name of the contact.",
101+
"misp-attribute": "last-name",
102+
"ui-priority": 3
103+
},
104+
"note": {
105+
"description": "Additional notes stored with the contact.",
106+
"disable_correlation": true,
107+
"misp-attribute": "text",
108+
"ui-priority": 0
109+
},
110+
"organisation": {
111+
"description": "Company or organisation associated with the contact.",
112+
"disable_correlation": true,
113+
"misp-attribute": "text",
114+
"ui-priority": 1
115+
},
116+
"phone-number": {
117+
"description": "Phone number associated with the contact.",
118+
"misp-attribute": "phone-number",
119+
"multiple": true,
120+
"ui-priority": 4
121+
},
122+
"raw-base64": {
123+
"description": "Raw contact-list record or export encoded in base64.",
124+
"disable_correlation": true,
125+
"misp-attribute": "text",
126+
"ui-priority": 0
127+
},
128+
"source-device": {
129+
"description": "Device, SIM card or account where the contact list was extracted from.",
130+
"disable_correlation": true,
131+
"misp-attribute": "text",
132+
"ui-priority": 1
133+
},
134+
"source-platform": {
135+
"description": "Platform or operating system of the source device/account.",
136+
"disable_correlation": true,
137+
"misp-attribute": "text",
138+
"sane_default": [
139+
"Android",
140+
"iOS",
141+
"Feature phone",
142+
"SIM card",
143+
"Google account",
144+
"iCloud",
145+
"Microsoft account",
146+
"Other"
147+
],
148+
"ui-priority": 0
149+
},
150+
"text": {
151+
"description": "Description and context of the extracted contact list.",
152+
"disable_correlation": true,
153+
"misp-attribute": "text",
154+
"ui-priority": 1
155+
}
156+
},
157+
"description": "Contact list object template for contact entries or aggregated contact-list extractions produced during forensic analysis (e.g. mobile extraction with Cellebrite, XRY or similar tools).",
158+
"meta-category": "misc",
159+
"name": "contact-list",
160+
"requiredOneOf": [
161+
"full-name",
162+
"phone-number",
163+
"e-mail",
164+
"contact-id"
165+
],
166+
"uuid": "92ead745-afda-4a59-ba59-7566d7c356bd",
167+
"version": 1
168+
}

0 commit comments

Comments
 (0)